FBI Urges Immediate Patching of Critical PHP Vulnerabilities Threatening Websites Worldwide

The Federal Bureau of Investigation (FBI) has urged businesses, government agencies and website operators to immediately address two critical security vulnerabilities affecting PHP, a widely used programming language that powers millions of websites and web applications. The warning, issued on October 23, 2026, follows an earlier alert from US cybersecurity authorities calling for urgent action against the flaws, identified as CVE-2026-109618 and CVE-2026-109619. According to the FBI, attackers could exploit the vulnerabilities to execute malicious code remotely on affected systems, potentially gaining access to confidential information and compromising business networks. The agency stressed that organisations should not delay installing available security updates because vulnerable internet-facing systems could become targets for cybercriminals.

PHP, which stands for PHP: Hypertext Preprocessor, is a server-side programming language commonly used to build dynamic websites, process online forms and connect applications to databases. It is an important component of popular website platforms and content management systems, including WordPress, Drupal and Joomla. Because PHP is so widely deployed, vulnerabilities in its core software can affect many organisations simultaneously rather than being limited to a single website or application. The US National Security Agency (NSA) warned on October 21 that the flaws could allow attackers to execute commands on vulnerable servers without authentication. This could potentially enable criminals to steal data, alter website content, disrupt services or move deeper into an organisation’s network.

The FBI’s latest advisory directs organisations to identify every system running an affected PHP version and install the relevant security updates immediately. Businesses are also advised to prioritise internet-facing servers and third-party products that include PHP as part of their software. If an organisation cannot apply the necessary updates promptly, the FBI recommends taking the affected system offline until it can be adequately protected. Website administrators should also monitor server activity for suspicious behaviour, including PHP processes unexpectedly launching command shells or downloading unfamiliar files. These measures are intended to reduce the opportunity for attackers to exploit the vulnerabilities while organisations complete their security assessments and patching procedures.

The warnings have prompted concerns across the global technology industry because of PHP’s extensive use and the potential consequences of successful exploitation. The Associated Press reported that the vulnerabilities were discovered with the assistance of artificial intelligence, highlighting how AI tools are increasingly being used to identify complex weaknesses in widely deployed software. Security researchers have warned that the same technological advances could also help malicious actors analyse vulnerabilities and develop attacks more quickly. However, the discovery of a security flaw does not automatically mean that every vulnerable system has been compromised. Authorities have emphasised the need for organisations to verify their software versions, apply the appropriate fixes and investigate suspicious activity rather than assuming that a lack of visible symptoms guarantees security.

The FBI has also outlined steps for organisations that suspect their systems have already been compromised. Affected operators should isolate vulnerable systems, preserve relevant web-server and PHP logs, and report suspected incidents through the appropriate law-enforcement channels. The Dutch National Cyber Security Centre similarly advised organisations to install the available PHP updates as soon as possible, noting on October 23 that the likelihood of widespread exploitation appeared lower than initially estimated, although investigations into possible exploitation continued. The centre nevertheless maintained that patching remains necessary and recommended keeping systems offline if they cannot yet be secured. The incident serves as a reminder that organisations must maintain accurate software inventories, monitor emerging threats and establish procedures for applying security updates quickly.